Everyone, our next talk is Skip Tracing for Fun and Profit by Rhett Greenhagen. So let's welcome him.
So like she said, my name is Rhett Greenhagen. If you're in the wrong track, you should still stay.
If you've never heard a gay autistic dude from Oklahoma crack jokes, I'm pretty fucking funny.
You're going to love it. You're going to love it.
So my talk is Skip Tracing for Fun and Profit, How to Hide from the FBI for the Recon Village.
First time I gave this talk, it was at DC 405 in Oklahoma City.
It ended with, because we were given the talk at IHOP, right?
And my best friend at the time, let's rewind just for a second.
We're given the talk at IHOP, and I start, and the waitress walks in.
She sees How to Hide from the FBI at the very front.
She starts flipping the shit.
She starts flipping the shit out.
County Sheriff's, Oklahoma Highway Patrol, Oklahoma City Police, right?
So they all arrive, and we're all getting patted down for weapons.
Because it's Oklahoma, we all have concealed carry, right?
Come to find out, my friend had assault weapons, suppressors, all the kind of illegal shit
that you don't want to have in a vehicle when the sheriffs come, right?
So he got labeled as a domestic terrorist.
All that.
All that good shit.
So to bypass that shit, we're going to do some legal stuff.
Let me just read through this shit just for a second.
If you have a TSSCI HCS clearance, you're going to want to be aware that the tools and techniques session
has been covered in certain training materials provided in my past companies
with inside the intelligence community.
But this has been reworked to be able to be given in a public setting.
It can all be recreated using open source information, et cetera, et cetera, et cetera, et cetera, et cetera, et cetera.
Working in future recovery for different state, local, and federal agencies,
different types of legal application processes,
such as warrants were arranged through state attorneys and such,
or whomever was the governing authority at the time.
Just so you know, I have no idea what any of this shit means.
The cases covered in the talk were completed before working for my current employer.
No state, local, federal, and or international laws were broken at this time.
The trace was being located, investigated, although the laws change all the time.
Please check with your SSO or FSO for details.
Although my current work involves some sorts.
Social media exploitation, intelligent analysis, counterintelligence,
and other forms of infiltration in my work with McAfee Advanced Programs Groups.
Is that of the most ethical and legal standards?
If anyone has any legal questions, please contact my attorney, Ryan Gillette.
I can give you details.
Just kidding, I just made that name up out of nowhere.
So this is my agenda.
No one gives a shit about that, so we're just going to bypass that for a second.
This is what skip tracing is.
Skip tracing is taking all this information and making a huge, huge compilation of data, right?
Right?
From there, you're going to start to come from where the whereabouts,
the data obfuscation, looking for misinformation, and things like that.
The end goal from this is taking all that shit on the left and getting real-time location.
All right?
Easy peasy stuff.
So, something I'm going to talk about is pivots.
Pivoting information, stop laughing, I'm making a point.
I'm just fucking with you.
Pivoting information for intelligent analysis is taking one piece of unique information
and be able to pivot to get another piece of information.
Say, for example, Red Greenhagen, you're going to get badass under there,
and then from badass, you're going to be able to find all other kinds of things,
like guns and, you know what I mean?
So, for a good example, actually, no, shit, I'm sorry, I forgot.
What are some good pivots from this?
Please.
I'm sorry?
Picture.
Who said picture?
Awesome.
Got something to say?
Anything else?
Woman?
What else?
Yes.
The time frame.
Time frame is huge.
And location.
Geopolitical locations are huge in analysis.
What else?
All right, we're going to skip through this.
So, reverse Google search in the avatar to find unique matches.
This is one of the ways how stupid fucking idiots get caught.
It's hilarious.
These anonymous wannabes that don't even know how to install IRC,
they have to actually do the IRC web client.
It's fucking hilarious.
They go and create some random,
random avatar with their initials.
It's just fucking tool bags.
Unique names are also pivotal in research.
So, the thing about Ukrania-Khrushchev is the region,
the region of Pakistan it comes from.
The KIS tells me that his family or his family members' ancestry
comes from either Eastern Europe or some form of Eastern Europe
or Middle Eastern descent, right?
Also, key phrases and questions can be searched to cross-reference.
For example, where's the FBI?
Where's the perfect place to hide the nouns he uses?
How he's using FBI in all kinds of letters and slashes?
As stupid as that sounds.
How he put them in order, FBI, CI, NSA.
And the way in the, how he uses pronouns in the sentence.
That is an awesome piece of information.
Say if I'm using that to do machine learning in IRC channels
and other pivotal information, I can gather a shit ton of more data.
It might not be accurate.
It's more percentage-based at that point.
And another thing is the, like you said,
the Pakistan 10 years ago.
Why did he say 10 years ago?
Why not five years ago?
Why not two years ago?
Why not my mom's house?
Why Pakistan?
And again, the one month ago.
It means it was posted one month ago.
Why one month ago?
And what does he post?
Post passants.
So if you're creating a timeline of his posts,
so say, for example, fuck, fuck, fuck, fuck.
How to hide, where would I hide from the FBI if I did this?
Oh, and another month later he posts, why would I do this?
And et cetera, et cetera.
Building a timeline of information like this
is amazing.
So about me, this is the places where I come from.
My first job and a bunch of other random shit.
I currently work for McAfee Security Advanced Programs Group
as a senior threat and malware researcher.
My entire career has come from the U.S. intelligence community.
I've never really had a job in the private sector
because I got fired.
So this is why you don't let Marines create your slide deck.
I have no idea what some of these things means.
I used to have bigger tits than most women.
You did not put that.
Humble eats a rocket.
No, I got that one.
But this is why you don't let Marines create your slide deck.
So talking about myself for a second because I love talking
about myself, just kidding.
I was diagnosed with Asperger's at age 11.
Didn't really fit into school.
Didn't really understand things.
My mom actually came home with a computer one day
and best thing that ever happened to me.
I taught myself C, taught myself all kinds of things
within a certain amount of time frame.
Now, having Asperger's in a very, very small town,
like living on a dirt road and like you're graduating class
from high school being like four, you don't really get
that much information, right?
So if you don't know what autism is or Asperger's,
I got some examples for you.
So this is what my mom thinks of people with Asperger's.
This is what I think someone with Asperger's is like.
And if you're a Democrat,
this is what you think Asperger's looks like.
.
So my brother's actually the one who got me started in this.
I was 14 years old.
He was working with US Marshals for fugitive recovery.
One day he came to me and this is after I got in trouble
with law enforcement.
He said, help me find this chick.
I said, no, that's okay.
So he gave me some cash and he went and bought me a video game.
I was like, fuck yeah.
.
Took me 30 minutes.
I thought, there's no way I'm going to find this chick.
There's no way, absolutely no way.
So I started thinking, if I was a white piece of trash
and only had $400 and I had to go from location A to location B,
which was actually pretty far, and get a hotel room,
knowing she was trying to get away from the US Marshals
in the city she was, I was thinking, this bitch has got to,
she's got to get out of state, right?
So I start calling, so I do a Google Map, right?
And in the API I start filtering.
I start filtering by cheap hotels along the route from location A to location B.
I swear to God in my mother's life, the first hotel I called, she was there.
So I, so I called and they transferred me to the room and the, and the,
and the phone rang, and they picked up the phone.
I fucking hung it up.
I had no idea what I was doing.
Like this is, this is, this is, and I called my brother and I said, oh, hey,
by the way, she's there.
She said, how'd you know?
Oh, I called her.
You did what?
So my brother.
My sister at the time was living, was living a long, long, long ways away.
But I was actually living in the city where she was.
So I, so we went there and there she is.
I couldn't believe it.
I was like, lady, you are so fucking stupid.
So this is about what I do now.
I currently work with three Marines that have black faces.
And, no, I'm kidding.
No, my current team is, was comprised of three Marines, myself and Dave Marcus
from .
The Marines have multiple combat tours.
They all came from a background of intelligence, capture-kill missions, special forces.
The multiple agencies that we work with all together, like the Joint, Joint Intelligence
Directive, INSCOM, which is Information Security Command, First I.O., Special Operations
Command, FBI, NSA, DIA.
So this is actually where we currently work out.
So this is the, the special operations mythology that's currently used.
It talks about, like.
So if you talk about the special operations stuff on the side, things like negotiating
settlements, larger and minor military conflicts, right, and the things underneath is like
propaganda, subversion.
So the things where APG operates at is on the, in the red.
Infiltrating foreign hacking groups based on the, based on the military's code.
So we profile foreign computer hackers based on the military's code.
We infiltrate those groups, build psychological profiles, do all kinds of interesting things.
So.
So I'm going to try and go through this, the tools and techniques part.
One of, one of my most popular, my favorite tools is Maltego.
Maltego allows me, with different APIs, to import information and share with my team.
Casefile is actually another tool outside of Maltego that allows me to work on a, on
a, on a nice canvas and be able to share things with other members of my team.
And they can, they can see my notes, I can see their notes, right.
Cool thing about this is I can input from multiple sources.
Multiple sources.
I think the last time I checked was a hundred and twenty-eight, a hundred and twenty, under
two hundred, over a hundred, all right.
Another amazing tool is Palantir.
Palantir is an amazing tool.
I actually use it for counterintelligence investigations for, for, for intelligence
agencies.
I remember one case, I was using Palantir, and our end goal was to find the person or
persons that was leaking the material from the agency.
I requested everything.
I requested DLP logs.
I requested batch access logs.
I requested CAG logs.
I swear to God, I swear to God, I requested receipts in digital format from the restaurant
within the federal agency, right.
Every single unique piece of information, Palantir ingested it.
And created a timeline of when the information could have been accessed, the chances and
percentage of the person who could have taken it, and then spits out one name.
Palantir is an amazing, amazing tool, if you have money.
NetGlove is a very, very, very under looked tool.
Palantir, not Palantir, I'm sorry, NetGlove, NetGlove is one of my favorite tools.
Absolutely one of my favorite tools.
It's own engine, be able to make modifications, be able to build other tools.
This is, this is my bread and butter.
From that we got Python, because you have so much information you need to, you need
to automate, right.
From Python you got the Google Maps API, we'll talk about more later.
The social engineer tool kit for mostly exploitation, cloning of websites, sending fake SMS messages,
shit like that.
Okay.
Mike Mazzelli's website is phenomenal.
Absolutely phenomenal.
His tools and techniques on the site, specifically on like the custom tools, they're so amazing,
it, I can't explain in words how amazing it is.
I think all together he has about a thousand, two thousand tools, like, like if I put an
email address in the tool kit and I click search, it's gonna come back with a profile.
Phone number does the forget password, comes back with a picture, it's, it's absolutely
amazing.
I can't say any better things about it.
Tools and techniques, the Google Alerts, a lot of APT groups and crimeware groups will
use Google Alerts for like hashes, hashes, call settings, things like that, or real
names.
A lot of the, a lot of the groups outside of advanced percentage threat actors will
have, they're like, their hashes of their new exploit kits are now on their pin on
Google Alerts.
Because they want to know if someone's searching for their, searching for that hash, they want
to know if, oh my God.
Oh my God.
Oh my God.
Oh my God.
Handles, unique, unique API calls.
Anything.
Anything.
Google Alerts is amazing, right.
And footprinting Google Alerts to see that the new hashes they're putting up is also
a very, very awesome technique.
So these are the some cases that I liked.
I put two on here.
So the first one.
So this guy.
Uh.
So, I, so, what I first started with was, I
had his real name, his criminal history, all the
other things that came up with this case, right.
So, from the real name, and I believe his
phone number, I came along with the jkidding31 at yahoo.com.
From the email address, I put in Maltigo.
I'm sorry, actually not Maltigo, I put in, in,
actually no, it is Maltigo, I apologize.
From that, I see his Steam profile, which is
an online gaming.
From the Steam profile, Steam profile, and the merging
of the phone number gives me five contacts that
I never knew about.
So that has an additional five contacts that I can use.
Come to find out, he's playing, I take his Steam
profile along with the numbers and I see his friends,
right.
So I use his Steam ID and look, look, look up his
Steam ID.
From his Steam ID, I find out he's playing Guild Wars
2.
From Guild Wars 2, I find the server he plays
on, along with the people he plays on.
And I find the guild he plays with.
Come to find out, they're looking for a healer.
I don't know what the fuck a healer is.
I've never played MLBG in my life.
Real men play Counter Strike Source.
I don't care what you have to say.
So from there, I bought a character that was a healer,
and went, I think I watched like maybe a one or two
YouTube videos trying to figure out how to play a healer.
And I teleported to him in game.
So from that, so from that, I'm like, yo guys, what's
going on?
You need a healer?
I swear to God, I was the best healer in that
game.
I swear to God.
Guys were like, dude, you got 112 hours?
I was like, I've just bought this fucking account.
Are you guys really that fucking stupid?
I'm literally right clicking, one, two.
Right clicking, one, two.
Fucking idiots, dude.
So, so the warrant falls under his name, right?
He's, he's dumb enough to host a fucking ventrilo server
from his own computer.
That means.
That means I own him.
So I couldn't get access multiple times to the ventrilo,
so I wrote an exploit to actually denial of service
to the ventrilo server, which was a remote procedural call
to the actual web client.
So taking that down, and this was actually planned.
And you have to keep in mind there's a lot of things
I'm taking out of my slides for, for OPSEC reasons.
But from that, I invited them all to a Steam call.
Because I knew if I did a Steam call, I can get
their IP addresses.
So from a Steam call, I used set plus the Google API.
To create a phishing link, which I had already planned
to get all their IPs of the people and the members
in the channel, right?
So from that, I do, I also do a part, I also
do a wire shark to be able to capture the IPs
in Steam chat.
I'm off Steam chat.
I'm sorry.
Steam voice.
I apologize.
This is back before it was patched.
So one IP address was actually in Lawton, Oklahoma.
From there, I do a master merge, which actually, it's a,
it's a Python script to merge all the information I currently
have to try and filter through Facebook, cell phone records, things like that.
To be able to get this one IP.
From there, I find a Facebook friend of his also lives in Lawton, Oklahoma.
From there, the guy has a phone number literally posted on his, on his, on his Facebook profile.
So from there, I use set to send him a text message saying, yo, dude, what's cracking?
Are we still up for night?
So when, you gotta think about it like this.
If they're living together, and he gets a weird text message from the guy's phone number
that doesn't really match up.
You know what I mean?
He's gonna think.
That doesn't, that doesn't, that doesn't add up.
So whenever you're doing something like this, and I'm not a legal authority, please keep
in mind, it needs to, it needs to match as possible to the type of conversation that
we would have.
Whenever you don't have things like, so there's some things I didn't have, like, I didn't
have access to his email yet, I didn't have access to his Facebook private messages yet.
So you gotta make it as bland as possible.
So I think I said like, are we still on the, no, I said something like, hey, what's up?
And he responded.
And I think the conversation went like, something like, yeah, yeah, I'm, I'm still home.
Are you coming home tonight?
Something like that.
So I knew they were living together.
So from that, there's the message I sent, and I got the physical address, and there's
the news article of him being arrested.
The, the tactical team requires, specifically, state, federal, state agencies require two
unique pieces of information to be able to verify the location of the target.
So if you just say, oh, hey, I got this dude's IP address from, from, you know, from, you
know, Wireshark, or, or, they're gonna be like, okay, we need another piece.
Does that make sense?
So at least two.
So these are the possible counters he could have done, other than being completely stupid.
I swear to God, in vitriol, he was talking to people about how he was on the run.
I swear to God.
He was like, yo, dude, yo, dude, I'm on the run, I'm, I'm, I'm a felon.
I'm, I'm on the run.
I'm so smart.
And the thing is, whenever you're doing stuff like this, you've gotta record everything.
You have to record everything.
Everything you do is recorded.
And I'm talking about on my end, whenever you're doing a skip trace, right.
And some of the conversations, dude, I swear to God, he was a walking meme.
One of the biggest things on here is, where's that, completely removed all social
media accounts.
He had multiple social media accounts.
That's why I made it so easy, putting a lot of stuff to Palantir and spitting out names
and phone numbers.
So another case.
You might not agree with what I do for work.
You might not agree with the tools and techniques that I use.
But let's, let's, let's use an analogy.
I respect Chinese actors.
I respect, I respect, I respect hackers, right.
I respect the guys that I go after, right.
I think it was Abraham Lincoln, I might be wrong, and please, God forgive me if I'm wrong.
The person who said, one man's freedom fighter is another person's terrorist, right.
There's always, there's always good and evil on both sides.
But if you can't agree with me that there is absolute evil in this world, you are fucking
ignorant.
There is absolute evil in this world.
This guy, um, let me get a drink.
This piece of shit.
Oh, no, no, wait before you start laughing.
Oh, no, no, wait before you start laughing.
He is, he, he is at home.
He meets this chick on a, on a dating app, right.
She has a kid.
They move in together along with the kid.
They were, they were, they were living in the house for about a nine month time period.
He was molesting her child for four months.
And by, by molest, I mean the absolute most horrific things you could possibly imagine.
Whenever, whenever the boy went and told his mom, he killed him.
He killed him.
In the most inhumane way you could possibly imagine.
There is absolute evil in this world.
So I started with this on full information, social address, phone number, plus some pre-texting
because the investigators that already did the work gave me, gave our team the case files
of the people who they, who was interviewed.
People known, known, LLCs, things like that, right.
So taking that, um, this was the first, this was the first graph with, uh, Google accounts,
form accounts, and a bunch of disinformation.
From that, I go into Palantir and I see his burners that are still associated with his
account right here, right.
And then the two computers, which actually this is inaccurate because the two computers
were actually one.
He was just trying to change his MAC address, so that, a little bit of that's inaccurate.
So I used master merge with all, with all the information that I had to try and combine
it into one and narrow it down.
He had a ridiculous amount of misinformation.
Ridiculous.
He was telling people, actually it's on my next fucking slide.
He was telling co-workers, the, the chick he was banging, he was talking to, uh, random
people, neighbors, uh, past employers, he was telling everyone something different.
I mean, one, one was talking about how he went to Missouri.
He actually went to Missouri, took pictures, and that's, that's a, that was like, that's
a six, seven hour drive just to do misinformation.
He, uh.
Fake, no one cares about that.
The Ontario stuff, he was setting up VPNs on Gmail addresses every time, making sure
it came from Ontario.
Using a VPN service that didn't actually look like a VPN.
So whenever I DRC it, or NS, I, it would look like it was a legitimate computer.
He was paying people in Kansas money to lie, right.
So actually, I learned a lot about, I actually learned a lot about myself in this case.
It's not, I'm not, I'm not an egotistical person, but it, you start to think, you start
to think.
People don't know there's people like me doing these type of things.
Does that, does that make sense?
And the amount of information, it, it was, it was unreal.
It was unreal.
I've never, I, so, I think I've done maybe, maybe around 200 cases altogether of things
like this.
I've never seen the amount of, I mean, I, I guarantee you, 200, 200, 250 fake social
media accounts, like actually legitimate set up, phone numbers, everything.
So, I found his, I found his Gmail address, game controller's Gmail address.
And one of the things he was checking was actually looking at the last known IP address.
So I actually had to match it, right.
So from there, I go to, take out the google.com and download all the stuff.
From there, so if you're not familiar with google.takeout.com, you can actually download
all your information.
The things I'm looking at is location history, his Google searches, and his Google voice,
right.
Location history.
If you've got your phone in your pocket, it's, it's, it's recording your walking, it's
recording your, your driving, it's recording your bus, you know, you know what I mean.
His Google searches, every Google search history that, well, I'm sorry, not every search Google
history, I apologize, but his Google search history as of the time, right.
From there, I narrow it down to eight contacts, a location history, which he has saved on
his phone, and his Google searches.
From this, it was very apparent that he was needing money bad.
And I mean a lot of money.
So, the address, come to find out, this is where he was living, and the contact phone
numbers in the Albany, New York, and recruiters, random associations.
He's trying to find a job, trying to, trying to speak to recruiters.
He did a lot of Google searches, like on monster chemical engineering, monster job.
He's looking for money bad.
Like he's spending his entire day not just looking for work, right.
So from there, I do a master merge, and then I find his resume that he's using on monster.com,
from his, from his resume, I find out what kind of job he's looking for, so I use, I
use set to clone a website that was, it's popular, I think it was in like Europe or
something like that.
But I changed some of the phone numbers, I changed some of the things on the website.
So from there, I went and created a monster profile.
Actually, I didn't change that slide, I apologize.
Some of the things on that slide talks about the, I forgot to edit it out.
I apologize.
Some of the things on the slide talks about how you want the information to match the
resume as closely as, as, as much as possible, not be like, oh, this is too good to be true.
A lot of things talking about working in a small team environment.
People that are on the run do not want to work on a large team.
The more people you talk to, the more chances you have of getting caught, right.
So from there, I post, I post the, post the monster article.
Within a certain amount of hours, I think it was six, five or six hours, get a response
back.
So get a response back, I sent him a response back with a malicious PDF.
It was talking about things like what, what the job posting's like, things, things that
we were looking for, right.
From that, I just verified his IP address.
And we actually had to hire a voice actor in the bottom right corner.
The voice actor acts as a go-between to where if they start calling, if he starts calling
the number to, to act like a monster.
Like hey, I want this job, I need more information.
They have a script they follow to try and set it up, because voice actors, I mean, I'm
not a voice actor.
I mean, I have, I might have a sexy voice, but that's as close as I'm gonna get.
So the thing, so what I won't discuss is why the, why the apprehension team would not go
to the house.
I, I can't discuss that, I apologize.
But they wanted to set it up to where he would go to this location, right.
So we have the voice actor tell him to go meet at this location at this time and to
wear nice clothes.
Like a legitimate interview.
And that's where, that's where NYPD and the other state, and the state law enforcement
and future recovery team is actually waiting.
So this is the actual, this is actually the time all together.
From the very first to the very end, this shows all the misinformation, the things
that misled, right.
It took a lot of time.
One of the biggest things that happens whenever you're doing skip traces at Target is whenever
you're working with a.
Specifically, like, local law enforcement or state law enforcement, they'll want you
to turn it into Crime Stoppers, and then from Crime Stoppers they'll get the trip
and then work together.
That keeps the, that keeps the legal processing stuff just, it's, it's more helpful to the
tracer, right.
Specifically the tracer on the team.
These are the possible counters.
I mean, these are pretty self-explanatory.
Yeah, I mean.
Yeah.
Another good thing is whenever you actually see law enforcement is not to assault them
and do stupid crap, right.
Also one of the biggest things whenever he was trying to apply for visas in other countries
was he was actually using his real name.
Whenever you have access, specifically to, like, LexisNexis and other things, like,
those type of databases, you can see the failed attempts, right.
So that's another huge thing trying to find, trying to find someone.
So this is actually my outro.
Some things I would explain if you're, if you're planning on going on the run.
It's to read A Hundred Ways of Disparently Free.
It's a really, really great book.
How to Steal a Job talks about how to act within an environment where you're on the
run.
And then special links to my parents.
My parents actually helped me, helped me actually be able to, what's the word, what's the word?
Operate within an environment, right.
Dave Marcus, Natalio, Matt, Sean, Ann, Wally, Black Days.
All of them.
Irwin, Irch, members of unallocated space, which allowed me to work this talk out with
them.
Dan Borges, and all, shut up.
And all the shit talkers who said it wasn't working.
Any questions?
Got to say a few?
So you said that APTs will tend to set up Google Alerts, right?
Like for like new explicates, new malware samples, things like that.
So where to see if they come up with new intel reports or say, or like buyer's toll comes
up and says, oh, hey, there's this.
Right.
Things like that.
What do you think, is that anomalous?
I can't think of, I can't think of a normal reason for me, an average person, to like
set up a Google or for a specific hash.
So.
So for like a private citizen, you'd want to do something like your social security
number, your phone number, your real name, right?
You need people to be able to do that.
You need people to be able to do that.
And you also, you want to tie it to more than just one.
So say, for example, if you do like your social and your name, you're going to get a better
percentage hit if you were just doing a social.
Right.
Right.
So I was thinking, like, if you were Google, would it make sense to, this is sort of a
.
Oh, did you?
Would it make sense to, like, say, if somebody is setting up Google Alerts for
hashes, like, maybe they might be APTs and maybe you might want to, like, flag their
account or whatever to see if they do anything.
See.
Yeah.
I'm not going to talk on that subject because that's a TTP, but that's a very, very good
line of thinking.
Questions?
I love questions.
Come on.
You can ask me where I got this shirt.
Sir?
Where did you get the shirt?
So that information from Google that you fed into your tools, was that privileged information
that you had access to in Google channels?
So all that stuff was covered in the, in the very first slide.
You have to understand that, you know, it's, it's, it's, it's, it's, it's, it's, it's, it's,
I'm trying to think how to word this.
It takes, whenever we do things through legal channels, it takes a great amount of time.
So I'm still planning on what to do once the information comes back.
So like now, we're doing, doing the warrant for information goes through Google and they'll
send us whatever things we need.
Does that make sense?
But these cases, these cases happened several years ago.
Sir?
All the tools you talked about with the exception of Palantir are they open source
and free?
I'm sorry?
All the tools you talked about with the exception of Palantir are they open source
and free?
Yeah.
.
Yeah.
Questions?
Sir?
Oh, thanks, sir.
You're not bad looking yourself.
Shut up, I was cracking a joke.
.
Okay.
So, I hate to be disrespectful.
I mean, I love giving talks, right?
There are some things that I can't say.
But can you re-ask the question in a way
if you were on a team, how to manage legends?
I don't drink alcohol.
But if you re-ask the question, I'm being serious.
If you re-ask the question, how to manage legends
within an environment, I'll be more than happy
to answer the question.
I'll ask the question for you.
If you had multiple legends, and you were working
in a team environment, how would you do it?
Dude, no fucking problem.
I have no problem answering that question.
So, one of the biggest things, specifically
in the CTA5 from DI Mythology,
is you have, say, if I die.
Someone needs to be able to pick up that work and carry on.
So, our legend will compromise the type of nouns, pronouns
we work with, like, full chat logs to see how I talk.
Like, the type of words I use.
Like, the type of lies that I say.
The VPN address that I use, right?
And so, where that legend can go from, look,
person A to person B, and they can continue the mission.
Does that make sense?
Awesome.
Good fucking job, dude.
Question, sir.
How many monitors do you have in the desk?
And what resolution are you trying to make?
So, I have co-workers in the room, so I can't lie.
But, I have a shit ton.
It's embarrassing.
No, like, I have the Dell four-split, right, on both sides.
Because I do a lot of Linux work.
And then I've got a shit ton of monitors.
It's fucking embarrassing.
So, sir.
You mentioned that the bad guys relatively don't realize
that there are youth that exist out there, right?
Yes.
How many youths are there, and are there going to be more of youths
to catch more bad guys?
Do I have time still?
When I was younger, I didn't know what skip tracing was.
I had no fucking clue what skip tracing was.
I read an article on Wired Magazine,
by Michelle Gomez.
OG gangsta.
Like, old-school hacker type, but she didn't know she was a hacker.
I hate to say this, and oh my God, I can't believe I'm saying this,
but I heard a quote a long time ago from Jason Street.
He said, some of the best hackers in the world don't own computers.
I thought he was just full of shit.
I never really cared.
I was like, it's Jason.
I'm just kidding.
And I was thinking, holy shit, he's right.
Some of the best hackers in the world are not technical.
Don't own computers.
They don't, they do machine sculpting, they do, fuck, I don't know,
just, I'm going to bullshit something, I don't fucking know.
But, I see how she worked, and I see how,
she's actually supposed to be my guest.
She actually wasn't able to make it.
I see how she worked, and I see how I work,
and I see how I come from a hacker background,
and I want to do something good for my country.
You know what I mean?
I want to do something good for, I want to serve my country.
I see how she did it, and she's the exact same way she went,
just, she just had different routes.
Like, she knows how to find boats,
she knows how to do, like, huge tankers that are being stolen, right?
It's, it's a very niche thing,
but this work helps me do more intelligent analysis to track other,
it's pretty much the same, same thing.
Did I answer your question?
Because I kind of rambled.
Not really.
So how many people do sort of what you do,
and are there going to be more,
because it seems like it's a pretty efficient way of finding people?
So, through all the work from,
from law enforcement that I worked with,
I think I met two or three actual hackers.
A lot of them are, like, former military
that know how to use database searches,
and they have the analytical thinking,
but they don't know how to do things like getting an Xbox Live IP address,
getting things, like the technical side of it.
Does that make sense?
Did I actually answer that time?
Dude, I apologize, my mind's racing.
Sir?
Can you tell us anything about,
have you ever encountered somebody
who you just could not track,
or how about, like, the hardest person you ever had to track down?
If you'll give me your phone number.
Yes.
Yes.
Three cases altogether.
Two of them killed themselves,
and one, it wasn't that,
I'm trying to think how to word this.
I'm trying to say legal, I sincerely apologize.
There's a list of things I can and cannot say,
and there's, like, only four things I'm supposed to be saying.
It wasn't, it wasn't the fact that I could,
I couldn't find him.
It was the fact that we couldn't legally apprehend him.
Does that make sense?
Like, like, everything I do is on a team environment,
and I swear to God, for every hacker on our team,
there's four fucking attorneys.
You know what I mean?
And sometimes, it comes to an art of,
the attorneys are saying,
no, it's going to break international law.
Even, even if they send me to, like,
Galapagos Islands, to where I can do most of my work,
to be able to, to be able to stay legal,
sometimes, like, most international law is not written.
Right?
It's always been,
dude, I'm sorry, my,
one of the big, biggest things in intelligence
is doing your, doing your steps.
What you did to start with, and where you went,
and whatever, as long as, even if I don't find them,
and I can give them to someone else,
they can match it, and carry on the mission.
But, sometimes, you just can't break the law.
And the law is so particular about one certain area,
specifically, like, on passports, and from foreign countries,
that sometimes you just say,
this is where, I know this is where his last known location was,
and there's nothing else I can do.
And it sucks.
It sucks.
Thank you, sir.
Anything, any other questions?
Sir?
I got one.
You mentioned earlier how the person you tracked down,
I think, like, several hundred AACs for one individual.
Yes. Yes.
How did you track, that's the part where, I guess,
what, 35, pretty quickly?
Oh, my, I'm sorry, my talk, actually,
I was told I was given 30 minutes from 45 minutes.
There was a,
I talk kind of fast.
So all I'm trying to figure out is, like,
when you went through, and after you start tracking at one, two, three,
like, how did you gather all of those?
So, gather through mostly closed source sources,
a lot of OSINT, a lot of other things,
but what the master merge does for me is say,
oh, the creation date of this Twitter account
doesn't match the time of this Gmail.
Or, this douchebag was here, but not here at this location.
Or, his passport entered this country at this time, but didn't,
so it's really good for finding misreported,
information.
Yeah?
Questions?
Ma'am?
One question.
I'm just fucking with you.
Yes.
As silly as it sounds, and I, I hate to play the autism card,
but I,
I,
I am very bad at putting things down.
I am very, very, very bad at putting things down.
Like, uh, the, uh, the, uh, uh, Hoover, the second case.
Um, oh, I wanted, I wanted to fucking destroy his life.
That was actually the last case where the agency would tell me the story,
because we learned our lesson, because Rhett is emotionally retarded.
All right?
It's very hard for me to put things down.
And I will, that's one of the reasons why I spent 510 hours on that one case.
Right?
It's,
it's very hard for me to put things down.
Um, one of the, one of the rules that I'm trying to follow now is,
if I find three unique pieces of information that don't tie together to two
information that I've confirmed, I say, okay, done.
I, I record it.
I say, here it is, Marines, and, you know what I mean?
What was your second question?
I sincerely apologize, but I won't answer that question.
I apologize.
Questions?
Sir?
Um.
To be absolutely honest with you, I'm not going to answer that question.
Um.
My best friend, um, actually has an OSCP and OSCE.
Extremely intelligent.
Extremely intelligent.
Love the guy to death.
But.
He's.
He's, I see how he can take a pen test mindset, and be able to go into an intelligence life,
uh, intelligence, uh, field.
Right?
If you have the hacker mindset, you've got the fucking hacker mindset.
You know what I mean?
It's, it's an experience thing that comes with time.
You know what I mean?
It's not about, it's like, it's like trying to study for the OSCE.
You can't study for the OSCE.
It's an, it's an experience thing.
You know what I mean?
I'm, I'm, like, like I said, um, I'd go dox dudes and anonymous that think they're hot
shit.
No, I'm, I'm being serious.
That's actually one of the first things I started doing.
Um, I can't stand people who go after private citizens.
I can't fucking stand them.
You don't call yourself a hacker and go after people who can't defend themselves.
Like, older couples, um, there was a, there was a dude that was living with his, with
his parents that his, because his credit was shot, because he went to.
In my own personal opinion, not speaking for my employer, hackers who call themselves hackers
and target personal lives to ruin them just for money, you can get the fuck out of here.
And that's my own personal opinion.
To me, that's not a hacker.
A hacker is someone who strives for knowledge, tries to, uh, dude, I'm rambling, I apologize.
But, uh, no, seriously.
Uh, some, some, there's, there's people out there, there's groups out there, and I'd
start just going through, I'd learn what doxing's all about.
Um, difference between illegal doxing and legal doxing.
You know what I mean?
And keep it to yourself.
And just practice.
Uh, that's actually one of the, uh, my niece, actually, and I'm actually not rambling, I'm
actually on, on topic now.
Um, my niece, um.
Had some things happen.
I love my niece to death.
Absolutely love her to death.
She's a pain in my ass, but I fucking love her.
Um, she had, she had some bad things happen.
And this guy, actually from, from, from Tulsa, Oklahoma, a hacker, which didn't even know
what, didn't even know how to spell Python, um, was just fucking with her.
I couldn't believe it.
Like, I go read this guy's Twitter and his Facebook, he's talking about how he's dropping
O-Day and all these CVEs.
I'm like, dude, you're a fucking tool bag.
You're a fucking tool bag.
You're using, you're using.
You're using whitepeople.com.
Not whitepeople.com.
The, the, the, the fucking, the white, the whitepages.com, right?
And I'm thinking, I'm done.
I'm fucking done.
I need a Xanax.
Just give me a second.
Go say monsieur.
I'm good.
Um, have you encountered any, I don't know, for lack of a better term, worthy adversaries?
Someone who.
Who is, has extreme skills and has.
Absolutely.
Covered their trails.
Absolutely.
Can you tell us a little bit about what you've seen?
Um.
I sincerely apologize, but I can answer that question.
I, I sincerely apologize.
I would love to.
I would absolutely love to.
But I apologize.
So, if we are out of time.
Find me outside.
We'll take a break.
I'm sorry?
It's out of time now.
All right.
Thanks, sir.
My God.
Man.
Society kills me.
Come on.
Gotta song, man.
All right.
Next question.